1937080 - Mitigate breakage risks for parent-process script security

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement)

Description

[Frederik Braun [:freddy]]

We should build logging to get insights into what kind of event handlers are added in the real world (document, element, position, event handler attribute, script source, JavaScript stack trace...).

We should be able to disable the enforcement mechanism at runtime (pref? remote settings?)

Comment 1

[Tom Schuster (MoCo)]

Attachment: Bug 1937080 - Make the <meta> CSP in browser.xhtml pref controllable. r?freddyb

Comment 2

[Tom Schuster (MoCo)]

Attachment: Bug 1937080 - Drive by cleanup: Don't pass the sample string to the GatherSecurityPolicyViolationEventData function. r?freddyb

Comment 3

[Tom Schuster (MoCo)]

Attachment: Bug 1937080 - Don't strip CSP report URIs when the mSelfURI is a chrome: URL. r?freddyb

Comment 4

[Tom Schuster (MoCo)]

Attachment: Bug 1937080 - Block inline event handlers in Nightly and collect telemetry. r?freddyb!,Gijs!

Comment 5

[Tom Schuster (MoCo)]

https://treeherder.mozilla.org/jobs?repo=try&revision=e8d0d912cdb830ae1698efc72c4734c5ee25b727

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3fade7db9688
Drive by cleanup: Don't pass the sample string to the GatherSecurityPolicyViolationEventData function. r=freddyb
https://hg.mozilla.org/integration/autoland/rev/c33b6add9eab
Don't strip CSP report URIs when the mSelfURI is a chrome: URL. r=freddyb
https://hg.mozilla.org/integration/autoland/rev/b835e8ac47e3
Make the <meta> CSP in browser.xhtml pref controllable. r=freddyb
https://hg.mozilla.org/integration/autoland/rev/a20a4eb224da
Block inline event handlers in Nightly and collect telemetry. r=freddyb,Gijs,saschanaz

Comment 7

[amarc]

https://hg.mozilla.org/mozilla-central/rev/3fade7db9688
https://hg.mozilla.org/mozilla-central/rev/c33b6add9eab
https://hg.mozilla.org/mozilla-central/rev/b835e8ac47e3
https://hg.mozilla.org/mozilla-central/rev/a20a4eb224da